backups/MinecraftConsoles
2
0
Fork 1
mirror of https://github.com/smartcmd/MinecraftConsoles.git synced 2026-08-20 09:57:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix 3 RCEs in packet parsing and texture loading

Browse source
This commit is contained in:
JuelzIrons 2026-03-09 23:40:18 -04:00
parent c998346312
commit 2498318e6e
2 changed files with 39 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Minecraft.Client/AbstractTexturePack.cpp
View file

@ -296,8 +296,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable()
const DWORD LOCATOR_SIZE = 256; // Use this to allocate space to hold a ResourceLocator string
WCHAR szResourceLocator[ LOCATOR_SIZE ];
// Try and load the HTMLColours.col based off the common XML first, before the deprecated xuiscene_colourtable
wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col");
swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col");
BYTE *data;
UINT dataLength;
if(XuiResourceLoadAll(szResourceLocator, &data, &dataLength) == S_OK)
@ -308,7 +307,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable()
}
else
{
wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/");
swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/");
HXUIOBJ hScene;
HRESULT hr = XuiSceneCreate(szResourceLocator,L"xuiscene_colourtable.xur", nullptr, &hScene);

42
Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp
View file

@ -209,15 +209,35 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo,
break;
case DQRConnectionInfo::ConnectionState_InternalRoomSyncData:
connectionInfo->m_pucRoomSyncData[connectionInfo->m_roomSyncDataBytesRead++] = byte;
// The room sync info is sent as a 4 byte count of the length of XUID strings, then the RoomSyncData, then the XUID strings
if( connectionInfo->m_roomSyncDataBytesToRead == 0 )
{
// At first stage of reading the 4 byte count
if( connectionInfo->m_roomSyncDataBytesRead == 4 )
{
memcpy( &connectionInfo->m_roomSyncDataBytesToRead, connectionInfo->m_pucRoomSyncData, 4);
int receivedSize = 0;
memcpy( &receivedSize, connectionInfo->m_pucRoomSyncData, 4);
delete [] connectionInfo->m_pucRoomSyncData;
connectionInfo->m_roomSyncDataBytesToRead += sizeof(RoomSyncData);
if( receivedSize < 0 || receivedSize > 100000 )
{
connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
connectionInfo->m_pucRoomSyncData = nullptr;
connectionInfo->m_roomSyncDataBytesToRead = 0;
connectionInfo->m_roomSyncDataBytesRead = 0;
break;
}
int totalSize = receivedSize + sizeof(RoomSyncData);
if( totalSize < receivedSize )
{
connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
connectionInfo->m_pucRoomSyncData = nullptr;
connectionInfo->m_roomSyncDataBytesToRead = 0;
connectionInfo->m_roomSyncDataBytesRead = 0;
break;
}
connectionInfo->m_roomSyncDataBytesToRead = totalSize;
connectionInfo->m_pucRoomSyncData = new unsigned char[ connectionInfo->m_roomSyncDataBytesToRead ];
connectionInfo->m_roomSyncDataBytesRead = 0;
}
@ -296,8 +316,20 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo,
// At first stage of reading the 4 byte count
if( connectionInfo->m_addFailedPlayerDataBytesRead == 4 )
{
memcpy( &connectionInfo->m_addFailedPlayerDataBytesToRead, connectionInfo->m_pucAddFailedPlayerData, 4);
int receivedSize = 0;
memcpy( &receivedSize, connectionInfo->m_pucAddFailedPlayerData, 4);
delete [] connectionInfo->m_pucAddFailedPlayerData;
if( receivedSize < 0 || receivedSize > 100000 )
{
connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
connectionInfo->m_pucAddFailedPlayerData = nullptr;
connectionInfo->m_addFailedPlayerDataBytesToRead = 0;
connectionInfo->m_addFailedPlayerDataBytesRead = 0;
break;
}
connectionInfo->m_addFailedPlayerDataBytesToRead = receivedSize;
connectionInfo->m_pucAddFailedPlayerData = new unsigned char[ connectionInfo->m_addFailedPlayerDataBytesToRead ];
connectionInfo->m_addFailedPlayerDataBytesRead = 0;
}